Intel vPro support overview

Management Suite supports devices using Intel vPro technology, a hardware and firmware technology that enables remote device management and security. Intel vPro uses out-of-band (OOB) communication for access to devices regardless of the state of the operating system or power to the device.

In this product, the term "Intel vPro" refers to technologies provided on desktop and mobile computers with Intel vPro support. This product also supports devices with earlier versions of Intel Active Management Technology (Intel AMT). The process for provisioning devices with different versions of Intel vPro varies according to the version numbers. The information in this section applies to all versions except as noted.

The following table lists Intel vPro features supported in this product in different versions of Intel vPro.

*A wireless profile is required for wireless management of Intel Centrino 2.5 notebooks. For Intel Centrino 2.6 notebooks, a wireless profile is required only to use Serial-over-LAN and IDE redirection features; other wireless management features can be used whether or not a wireless profile exists on the notebook.

LANDesk Management Suite includes the following features for managing Intel vPro devices:

• Automatic generation of provisioning IDs (PID/PPS pairs)
• Changing the password for managed devices
• Configuring and enabling System Defense and Enhanced System Defense policies
• Configuring and enabling Agent Presence monitoring
• Wireless support for mobile Intel vPro devices
• Managing Intel vPro devices (including power management)
• Remote access for Intel vPro devices

Managing devices with or without management agents

When devices are configured with Intel vPro, a limited number of management features are available even if the device does not have a LANDesk agent installed. As long as devices are connected to the network and have standby power, they can be discovered and can be added to the database to be managed with other devices on the network.

If a device has Intel vPro but no management agent installed, it can be discovered, added to the inventory database, and viewed in the My devices list. Management features that are available for Intel vPro-configured devices include:

• Inventory summary: A subset of the normal inventory data can be queried and viewed in real time for the device even if the device is powered off.
• Event log: A log with Intel vPro-specific events, showing severity and description of the events, can be viewed in real time.
• Remote boot manager: Power cycling and several boot options can be initiated from the remote management console, regardless of the state of the device's OS or power. The options available are dependent on support for the options on the device. Some devices may not support all boot options.
• System Defense: The Intel vPro System Defense feature enforces network security policies on managed devices. Enhanced System Defense (release 3.0) adds heuristic filtering rules to prevent malicious software attacks on the network.

Other Management Suite management options are available only when a management agent is installed on the device. For more information about management options, see Managing Intel vPro devices.

Intel AMT version 1.0 provisioning requirements

Devices can be discovered as Intel AMT 1.0 devices only after you have accessed the Intel AMT Configuration Screen on the device's BIOS and changed the manufacturer's default password to a secure password (refer to the manufacturer's documentation for information on accessing the Intel AMT Configuration Screen). If you haven't done this, the devices will be discovered but not identified as Intel AMT devices, and you won't be able to view the same inventory summary information as you otherwise would.

In order for the core server to authenticate with discovered Intel AMT devices, the username/password credentials you enter in the device BIOS must match the credentials that you enter in the Intel vPro general configuration dialog.

When an Intel AMT device is added to the core database to be managed, Management Suite automatically provisions it, regardless of whether it has already been provisioned. Small business mode provides basic management without network infrastructure services and is non-secure, while Enterprise mode is designed for large enterprises and uses DHCP, DNS, and a TLS certificate authority service to ensure secure communication between the managed device and the core server.

When you provision an Intel AMT device in Enterprise mode, the core server installs a certificate on the device for secure communication. If another computer attempts to access the Intel AMT functionality on the device, it will not succeed because it does not have a matching certificate.

Intel vPro device management 

After an Intel vPro device has been added to the core database to be managed, it can be managed in limited ways even if the device does not have a LANDesk agent installed. (See Discovering Intel AMT devices for information on discovering devices and adding them to the core database).

The following table lists the management options available for a device that has Intel vPro only compared with a device that has Intel vPro and a Management Suite management agent installed.

To view the Intel vPro inventory summary for a device

In the All devices list, right-click an Intel vPro device and select Intel vPro options > Intel vPro summary.

The summary shows general information about the device, such as device name and IP address, as well as information specific to the Intel AMT chip and the Intel vPro device hardware, such as AMT version number, BIOS, manufacturer, and serial number.

Accessing devices provisioned with Enterprise mode

When you provision an Intel vPro device in Enterprise mode, the core server installs a certificate on the device for secure communication. If the device is to be managed by another core server, it must be unprovisioned and then re-provisioned by the new core server. If not, the device's Intel vPro access will not respond because the new core server does not have a matching certificate. Similarly, if any other computer attempts to access the Intel vPro functionality on the device, it will not succeed because it does not have a matching certificate.

Intel vPro event log

Management Suite provides a view of the event log that Intel vPro devices generate. The settings determine what events are captured in this log. You can view the date/time of the event, the source of the event (Entity column), a description, and the severity as determined by the Intel vPro settings (Critical or Non-Critical). You can also export the log data in comma-separated value (CSV format).

To view the Intel vPro event log

1. In the All devices list, right-click an Intel vPro device and select Intel vPro Options > Intel vPro Event Log.
2. To export the data in a comma-separated value (CSV) file, click the Export button on the toolbar and specify a filename.
3. To clear all data in the log, click the Clear log button on the toolbar.
4. To update the log entries, click the Refresh button on the toolbar.

Intel vPro power options

Management Suite includes options to power on and off Intel vPro devices. These options can be used even when a device's operating system is not responding, as long as the device is connected to the network and has standby power.

When Management Suite initiates power option commands, in some cases it is not possible to verify that the commands are supported on the hardware receiving the command. Some devices with Intel vPro may not support all power option features (for example, a device may support IDE-R reboot from CD but not from a floppy). Consult the hardware vendor's documentation if it appears that a power option is not working with a particular device. You may also check for any firmware or BIOS upgrades from Intel for the device if power options do not work as expected.

For Intel vPro devices, when you issue a power-on command, Management Suite will first send an Intel vPro wake up command. If that command is not successful, it will then send a normal Wake on LAN command to the device.

You can simply turn on or off the device's power, or you can reboot and specify how the device is rebooted. The options are described in the table below.

To use Intel vPro power options

1. In the All devices list, right-click an Intel vPro device and select Intel vPro Options > Intel vPro Remote Boot Manager.
2. Select a power command.
3. If you select Reboot, select a boot option.
4. If you select the IDE redirection boot method, specify a floppy or CD drive or an image file.
5. If an IDE-R session is still open and you want to close it, click Close IDE-R session.
6. Click Send to initiate the power command, or click Close.

Notes on using IDE redirection options

When using IDE redirection options, floppy image files must be in .img format and CD image files must be in .iso format. Some BIOSes may require the CD image to be located on a hard drive.

Intel vPro normally remembers the last IDE-R settings, but Management Suite clears the settings after 45 seconds, so on subsequent boots it will not restart the IDE-R feature. The IDE-R session on an Intel vPro device lasts 6 hours or until the Management Suite console is turned off. Any IDE-R operation still in progress after 6 hours will be terminated.

NOTE: In some situations, an IDE-R boot process may appear to time out on the serial-over-LAN (SOL) console, when the boot process is actually still in process. If the boot image takes too long to initialize and send data to the SOL console, the SOL console will stop communicating and keyboard connectivity is lost. This occurs when the media used for booting has a slow response time and takes longer than 60 seconds to initialize (which is the longest timeout value allowed). If you experience this problem when booting with a floppy disk or other media, we recommend that you boot from a boot image (.img) file rather than from a removable media.

Remote access for Intel vPro devices

Intel vPro devices (version 4.0 and later) can be managed remotely from a LANDesk Management Suite console. When an Intel vPro device is outside the network on which the Management Suite console is located, communication to the core server—through the network’s firewall and DMZ—is enabled by the remote access functionality.

Remote access for Intel vPro devices enables communication between a management console inside a secure network and Intel vPro devices located outside the network. This communication is through a TLS tunnel that connects the device outside the network with a server (called the Intel vPro Gateway Server) that is typically located in the network’s DMZ. Communications to the Intel vPro Gateway Server are in turn sent to the Management Suite core server by secure HTTP connections, using trusted root and server certificates.

For a managed device to use remote access, it must have a remote access policy applied in its firmware. It must also have two certificates, a trusted root certificate and a client certificate, that match the Management Suite core server certificates. (These are the same certificates that are used in LANDesk products.) Remote access features let you create a remote access policy and apply it to the firmware of the managed devices.

When you have configured the device and set up the Intel vPro Gateway Server, remote sessions from the managed device are opened on a regular schedule that you specify (typically once a day). When a remote session is initiated, the device is listed in the Open Session list in the Intel vPro Remote Access Configuration dialog box. In addition, the client status page in Management Suite indicates that the session is open.

NOTE: Note that as remote access was being developed, it was named Client-Initiated Remote Access, or CIRA. If you see references to CIRA, they refer to Remote Access. The Intel vPro Gateway Server was formerly named the Management Presence Server (MPS), so you may see references to MPS that are related to the Gateway Server. In addition, Intel documentation may refer to Fast Call for Help, which is the remote access option initiated by the client device.

You can enable remote access by using a server in your network to act as an Intel Gateway Server. This requires the following two general tasks:

• Run an installation executable on a server and configure the server for use as an Intel vPro Gateway Server
• Configure Remote Access Configuration and Network Environment Detection options on the Management Suite core server

Documentation for setting up remote access is located on your core server, in the \Programs Files\LANDesk\Management Suite\Install\vpro\remoteaccess folder. (This is the folder where the executable file is found.)